In brief
- Bitcoin Depot disclosed that hackers stole 50.9 $BTC worth $3.665 million from company wallets in a March 23 breach.
- Attackers gained access to IT systems and obtained digital asset settlement account credentials.
- Customer platforms and data were not affected, according to the company.
Bitcoin ATM operator Bitcoin Depot Inc. disclosed in an SEC filing Wednesday that hackers stole approximately 50.9 $BTC valued at $3.665 million from company-controlled wallets in a March 23 security breach.
The attackers gained access to the company’s IT systems and obtained credentials for digital asset settlement accounts, enabling them to transfer the cryptocurrency without authorization.
Following the breach discovery, Bitcoin Depot said it activated its incident response protocols and engaged external cybersecurity experts to investigate the attack vector and secure remaining assets. The company also notified law enforcement authorities, though it did not specify which agencies are involved in the investigation.
Despite the settlement account compromise and loss of assets, Bitcoin Depot stated that its customer-facing platforms and user data remained unaffected by the intrusion.
Bitcoin Depot has yet to make a public statement on the breach, as of this writing, aside from the SEC filing. Decrypt reached out to a company spokesperson for comment, but did not immediately receive a response.
The company classified the incident as material to its operations, citing potential reputational damage alongside legal, regulatory, and incident response costs. Bitcoin Depot recorded a preliminary loss estimate of $3.665 million based on Bitcoin’s value at the time of the theft.
The disclosure did not specify whether the company maintains insurance coverage for digital asset thefts or how the loss might impact its Bitcoin ATM liquidity operations across its machine network.
Bitcoin ATM operators have emerged as attractive targets for cybercriminals due to the significant cryptocurrency reserves they must maintain to facilitate customer transactions. These firms face unique security challenges as they bridge physical cash-to-crypto infrastructure with digital custody systems.
This marks at least the second known security incident at Bitcoin Depot, following a 2023 breach where hackers accessed personal data for 58,000 users. The company has also faced mounting regulatory scrutiny, recently implementing stricter identity verification requirements for all ATM transactions as authorities increase oversight of Bitcoin ATM operations.
Shares in Bitcoin Depot (BTM) spiked 15% during the trading day to finish at a price of $2.74, but have ticked down after hours following the SEC disclosure. The company’s shares are down 44% over the last 30 days.